Route uvx/npx .mcpb downloads via releases.stackql.io and set distinct per-vector UAs

[jeffreyaven]

Intent

The published pypi and npm wrappers fetch the .mcpb from github.com directly (baked baseUrl), and the npm vector sends no User-Agent. Route both through the releases.stackql.io proxy and emit distinct, versioned UAs.

Current state

• render-pypi-manifest.sh and render-npm-manifest.sh set baseUrl to github.com/stackql/stackql/releases/download/v$VERSION.
• pypi wrapper UA: stackql-mcp-server (no version).
• npm wrapper: fetch with no UA (undici default).

Changes

1. Repoint baseUrl in both render scripts:

- RELEASE_BASE="https://github.com/stackql/stackql/releases/download"
- base_url="$RELEASE_BASE/v$VERSION"
+ RELEASE_BASE="https://releases.stackql.io/stackql"
+ base_url="$RELEASE_BASE/v$VERSION"

2. pypi wrapper UA (pypi/src/stackql_mcp_server/__init__.py):

+ from importlib.metadata import version
- req = urllib.request.Request(url, headers={"User-Agent": "stackql-mcp-server"})
+ req = urllib.request.Request(
+     url,
+     headers={"User-Agent": f"stackql-mcp-server-py/{version('stackql-mcp-server')}"},
+ )

3. npm wrapper UA (npm/bin/stackql-mcp.js):

+ const { version } = require("../package.json");
- const res = await fetch(url, { redirect: "follow" });
+ const res = await fetch(url, {
+   redirect: "follow",
+   headers: { "User-Agent": `stackql-mcp-server-npm/${version}` },
+ });

Acceptance

• uvx/pip installs fetch .mcpb from releases.stackql.io
• npx installs fetch .mcpb from releases.stackql.io
• proxy logs show stackql-mcp-server-py/<version> and stackql-mcp-server-npm/<version>
• sha256 pins still validate

Notes / depends on

• Worker must serve versioned paths releases.stackql.io/stackql/v{version}/*.mcpb (and .sha256).
• After the base_url repoint, the build-time .sha256 curl in the render scripts also hits the proxy (acceptable). Split into a separate build-only var if you want that fetch to stay on GitHub.
• Confirm version('stackql-mcp-server') matches the published distribution name.

Additional constraints

• this issue should not trigger a new mcpb build, this is a distribution related fix only